Despite the privacy-preserving capability introduced by FL, recent works have empirically demonstrated that the classic federated averaging method (FedAvg [1]}) and its variants (e.g., FedProx [2]}) are vulnerable to gradient-based data recovery attacks such as the deep leakage from gradients (DLG) [3]}, which is able to reconstruct the original data of clients from publicly shared gradients and parameters. Varieties of technologies have been leveraged to further improve the privacy of FL, the most popular ones are homomorphic encryption (HE) [4]}, [5]} and differential privacy (DP) [6]}. HE provides a high-level security guarantee by encrypting exchanged information among clients. Nonetheless, its extremely high computation and communication cost make it unsuitable to DNN models that typically consist of numerous parameters. While DP imposes a low complexity on FL, it causes precision loss and still suffers from data recovery attacks. To prevent data leakage and still enjoy the benefits of FL, FedSplit [7]}, [8]} combining split learning [9]} and federated learning proposes to split a client's network into two portions, a private extractor and a public classifier, and shares only public classifiers with the server. However, FedSplit experiences a non-negligible performance drop because private models are not enhanced by common knowledge.
